Watchguard Firebox X1000, User Manual

Page: 250 / 314

Chapter 13: Reviewing and Working with Log Files
228 WatchGuard Firebox System
IP header length
Length, in octets, of the IP header for this packet. A
header length that is not equal to 20 indicates that
IP options were present. Default = Hide
TTL (time to live)
The value of the TTL field in the logged packet.
Default = Hide
Source address
The source IP address of the logged packet. Default
= Show
Destination address
The destination IP address of the logged packet.
Default = Show
Source port
The source port of the logged packet, UDP or TCP
only.
Default = Show
Destination port
The destination port of the logged packet, UDP or
TCP only. Default = Show
Details
Additional information appears after the
previously described fields, including data about
IP fragmentation, TCP flag bits, IP options, and
source file and line number when in trace mode. If
WatchGuard logging is in debug or verbose mode,
additional information is reported. In addition, the
type of connection may be displayed in
parentheses. Default = Show
Working with Log Files
The Firebox continually writes messages to log files on the
WatchGuard Security Event Processor (WSEP). Because